Security & How Your Funds Are Protected

Bundie is designed with security and transparency first. This guide explains how your funds are protected and what security measures are in place.

Non-Custodial Architecture

You Always Control Your Assets

What this means:

• Only you can deposit, withdraw, or allocate funds
• Your private keys never leave your wallet
• Bundie smart contracts are proxies, not custodians
• No admin backdoors to access user Accounts

How it works:

Traditional Finance:
You → Bank (holds your money) → Investments
Risk: Bank can freeze, lose, or misuse your funds

Bundie:
You → Your Account (you control) → Yield Strategies
Risk: Only smart contract risk, no custodial risk

Your permissions:

• Deposit assets to your Account
• Allocate funds to strategies
• Withdraw from positions
• Withdraw from your Account to wallet
• Recover stuck ETH

Bundie CANNOT:

• Withdraw your funds
• Move your assets without approval
• Freeze your Account
• Block your withdrawals
• Access your private keys

Smart Contract Security

Audited Contracts

Bundie's core smart contracts were audited by Sherlock (April 2026), with critical findings fixed before mainnet launch and re-audits run on significant changes. The full report, including severity ratings and remediation status, is public: Bundie Collaborative Audit Report — Sherlock (April 2026).

Deployed Contracts

The full contract stack is deployed on each supported chain: Arbitrum (hub), Base, Optimism, Avalanche, and Scroll (legacy). Select a chain to see its verified addresses.

You hold one Account per chain — a personal smart contract deployed as a beacon proxy by AccountManager the first time you use that chain. You can look up your own Account address on the relevant block explorer after creation.

Beacon Proxy Pattern

Your Account is an upgradeable beacon proxy: all Accounts share one implementation, so security patches apply everywhere at once without you migrating funds, and your Account address never changes.

Upgrade safety:

• A 1-day timelock is enforced by the contract, so every upgrade is announced in advance
• Upgrades cannot access or move user funds, and all positions are preserved
• If you're not comfortable with a proposed upgrade, you can withdraw during the timelock

Reentrancy Guards — all deposit, withdrawal, allocation, and cross-chain operations are guarded against reentrancy and recursive-withdrawal attacks.

Whitelisted Tokens — only approved assets can be deposited, which blocks fake or malicious tokens. The current whitelist is USDC, USDT, ETH, and WETH; adding a new token requires a security review and governance approval.

Slippage Protection — every cross-chain deposit, withdrawal, and swap sets a minimum acceptable output. If the result would fall below it (unfavorable rates, fee spikes, low liquidity), the transaction reverts and your funds stay in your Account — you only pay gas.

Validator Trust Model

A validator monitors cross-chain operations and confirms them on-chain — it acts as a notary, not a custodian.

What it does: watches for bridge delivery, confirms completed deposits/withdrawals, and flags failed operations so funds can be refunded.

What it can't do: it holds no keys and has no spending permission, so it cannot move your funds, withdraw on your behalf, block your withdrawals, or fabricate a position you don't actually hold. The worst case is a delay in confirmation, never loss of funds.

Transparency: every validator action is recorded on-chain, so you can independently verify any confirmation against LayerZero Scan and the relevant block explorer.

Bridge Security

Cross-chain moves use LayerZero, an industry-standard messaging protocol used by 100+ protocols and audited by multiple firms. A transfer only updates your Account after the destination chain confirms receipt, and every step is publicly verifiable — the source and destination transaction hashes, the LayerZero message GUID, and the validator's confirmation are all on-chain (track via LayerZero Scan).

Failed Bridge Handling — if a bridge message fails to deliver, the destination protocol rejects the deposit, or an operation gets stuck, the validator flags it as failed on-chain and your funds are refunded to your Account. Manual recovery is available as a last resort, so funds are never permanently lost.

Emergency Recovery

Stuck ETH Recovery — if ETH ever ends up stuck in your Account (an accidental transfer, a refund), you can recover it to your wallet at any time from Account settings. It's a user-only action — no team approval required.

Failed Bridge Recovery

Failed bridges refund automatically (see Failed Bridge Handling above). If a refund doesn't go through, contact support with your operation's message GUID and the team will help you recover — funds are never lost, only delayed, and every recovery action is on-chain and verifiable.

Lost your message GUID? The transaction hash works for recovery too — or contact support with your Account address and the approximate time, and the team can locate the operation on-chain.

Protocol Risk Management

Strategy Vetting Process

Before a strategy is listed it must pass: an independent security audit with no critical findings, a maturity bar (≥ $10M TVL, 90+ days live, no major incidents), an ERC-4626-compatible interface (or a tested adapter), and reliable, manipulation-resistant price oracles. Listed strategies are then monitored continuously for TVL, APY anomalies, and incidents.

Risk Isolation

Position-level isolation:

• Each position is independent
• Exploit in one protocol doesn't affect others
• Your Account holds receipt tokens, not base assets directly

Example:

Your portfolio:
- 1,000 USDC in Aave (Arbitrum)
- 1,000 USDC in Morpho (Base)
- 1,000 USDC in Compound (Optimism)

If Aave is exploited:
 Morpho position unaffected
 Compound position unaffected
 Aave position may lose value
Risk: Limited to 33% of portfolio

Diversification — spreading across protocols and chains means no single point of failure, and bundles diversify automatically.

Incident Response

If an external protocol suffers a security incident, the affected strategy is disabled to new deposits and impacted users are notified (dashboard, email, and our channels) with recommended actions. You can exit the affected strategy at any time — move funds to another strategy or withdraw to your wallet — and we post updates as the situation develops.

Red Flags to Watch For

• 🚩 Sudden large APY increases (may indicate exploit)
• 🚩 Withdrawal delays (check protocol status)
• 🚩 Unusual Account balance changes (verify transactions)
• 🚩 Unannounced contract upgrades (should never happen)

If you see any of these: stop new deposits, check official channels, verify on-chain, and contact support.

Next Steps

• Risk & Security Overview - High-level security summary
• Bundie Collaborative Audit Report — Sherlock (April 2026) - Full audit report and findings
• Troubleshooting Guide - What to do if something goes wrong
• Key Concepts - Understanding the technical architecture

Ready to start securely? Launch Bundie App →